2608.07063-Soft Redaction of Image Provenance via Zero-Knowledge Proofs

Introduction to the show: ident: Paper Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "Soft Redaction of Image Provenance via Zero-Knowledge Proofs".

Jane: The paper was written by Muhammad Awan and John Collomosse from University of Surrey and Adobe Research.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Paper summary: Tom: We've got a paper that finally gives provenance a privacy setting. It soft-redacts image metadata using zero-knowledge proofs.

Jane: So instead of deleting sensitive assertions, you attach a proof that the hidden value satisfies some claim. Like "this photo was taken within 50 km of a public point" without revealing the actual GPS coordinates.

Lu: That's the core trick. They call it soft redaction. It sits on top of C2PA's existing hard redaction, so the hash of the original assertion stays signed and audit trails survive.

Meng: They run it through three use cases. Location privacy, facial likeness checks for personality rights, and visual fingerprint anti-spoofing for watermark recovery.

Lalam: The unifying primitive is a distance proof. Prove that a secret descriptor lies within a radius of a public reference, without leaking the descriptor itself.

Tom: And they made it practical. A PLONK-based circuit, chosen over Groth16 and Bulletproofs. Proofs in seconds, verification around 300 milliseconds.

Jane: That's a big deal for a publisher processing thousands of images. Groth16 might be faster, but it needs a new trusted setup per circuit. PLONK works with one universal setup.

Lu: The location proof needed math gymnastics. Trigonometric functions inside the circuit are expensive, so they approximated Haversine distance with Chebyshev polynomials. Degree-5 gave errors as low as 36 metres at city scale.

Meng: For faces, they tested ArcFace, FaceNet, AdaFace, ElasticFace. All 512-dim embeddings. Proof generation around 6.7 seconds, verification around 320 milliseconds.

Lalam: What matters to me is the framing. Provenance creates tension: the evidence that builds trust also exposes people. This paper offers a middle path between full disclosure and blind redaction.

Tom: And it's compatible with existing C2PA. No spec changes needed, just a custom assertion type.

Jane: But the proof has to stay bound to the original signed manifest. That anchoring is the subtle piece, and it sets up everything else.

Lu: We'll get there. The first page lays out the problem and the promise. Curious how they frame the stakes from the very start.

Page 1 of the paper: Tom: The opening page sets up the battlefield: generative eye, media transparency, and the quiet panic about consent.

Jane: They mention C2PA's growing adoption. Leica, Nikon, Canon, Google Pixel, even ChatGPT and Photoshop. The standard is everywhere.

Lu: But then they drop the tension: provenance transparency can collide with privacy. A photojournalist in a conflict zone may not want their exact location published.

Meng: And redaction alone weakens the evidence. You lose the ability to verify any property of the hidden metadata. The paper wants a middle ground.

Lalam: Exactly. Soft redaction replaces an assertion with a zero-knowledge proof about that assertion. You keep trust, you lose the exposure.

Tom: They also lay out three contributions up front. GPS proximity proofs, biometric likeness proofs, and fingerprint-based recovery. All share the same distance-proof core.

Jane: The biometric angle is striking. They're not just protecting metadata; they're protecting people's faces. Personality rights are becoming a legal battleground.

Lu: And the fingerprint part is about spoofing. Watermarks can be stripped and copied, so you need a visual fingerprint to confirm the recovered manifest actually belongs to the image.

Meng: The abstract promises proofs "constructed in seconds and verified in milliseconds." That's the headline number I remember.

Lalam: What's smart is they don't try to solve every predicate. Distance is the workhorse. Most privacy claims reduce to "how far apart are two things".

Tom: They also cite the C2PA spec and mention ISO, so this is aligned with an actual standard, not a toy.

Jane: And they position it as complementary to prior work on ZKP image transformations. PhotoProof, ZK-IMG, VerITAS. Those prove edits to pixels. This paper proves properties of metadata.

Lu: I like that they're acknowledging the social context. Generative eye made provenance necessary, but also made privacy more fragile.

Meng: So the big question becomes: how do you compute a distance proof without leaking the secret? The next page introduces the systems they compared.

Tom: And why they chose PLONK. That decision shapes everything downstream.

Page 3 of the paper: Jane: We've moved into related work, and it's actually crucial to the design. The paper sorts through prior provenance systems before picking a ZKP family.

Tom: Right. They trace the lineage from ARCHANGEL's blockchain archives to C2PA's signed manifests. Media trust moved from institutions to technology.

Lu: ARCHANGEL used visual fingerprints plus blockchains to protect public archives. That was early thinking about persistent provenance.

Meng: Then C2PA standardized the metadata layer. But the paper notes a weakness: social platforms strip that metadata all the time.

Jane: So they bring in invisible watermarking as a recovery tool. TrustMark is one example. Watermarks carry a short ID, and that ID points back to the manifest.

Tom: But watermarks can be spoofed. An attacker can transplant an identifier from one image to another. That's where fingerprints step in for verification.

Lu: On the ZKP side, they compare three families. Bulletproofs have no setup but verification grows with the circuit. Groth16 is small and fast, but every circuit needs its own trusted ceremony.

Meng: PLONK sits in the middle. Universal setup, constant-size proofs, constant verification time. That's why they adopt it.

Jane: They also mention Paillier encryption as the old-school route. Proof and ciphertext both scale with secret dimension, which kills it for high-dimensional embeddings.

Tom: The visual ZKP predecessors, PhotoProof and ZK-IMG, were about proving image transformations. This paper's move is different: prove properties of the assertion data itself.

Lu: They're not touching the pixels at all. The witness is the metadata, not the image.

Meng: And then they slide into face recognition. ArcFace, AdaFace, ElasticFace, FaceNet. All produce unit-normalised embeddings where matching is just ℓ2 distance.

Jane: That's convenient, because the exact same distance predicate can be reused. One circuit, many applications.

Tom: So the related work is really a puzzle assembly. Provenance recovery needs fingerprints, fingerprints need distance comparison, distance comparison needs ZKPs.

Lu: And PLONK fits the constraints: bounded proof size, fast verification, no per-circuit ceremony.

Jane: The stage is set. Next page they formalize soft redaction and dive into the GPS approximation. That's where the practical engineering starts.

Page 5 of the paper: Tom: Now we're inside the mechanism. The paper defines soft redaction as a tuple: a commitment, public parameters, and a zero-knowledge proof.

Jane: The commitment binds the hidden assertion value, and the proof shows that value satisfies a predicate. They hard-redact the original assertion, keeping its hash in the signed claim.

Lu: The hash is the anchor. It lets anyone audit that a redaction happened, even though the actual value is gone.

Meng: Then they focus on distance predicates. Prove that a secret vector sits within a radius of a public reference. That's the workhorse for all three use cases.

Tom: First test case: GPS coordinates. The Haversine formula for great-circle distance involves sines and cosines, which are expensive inside a ZKP circuit.

Jane: So they reformulate. Instead of comparing distances directly, they compare the Haversine accumulator against a precomputed threshold.

Lu: And they approximate the trig functions with Chebyshev polynomials. Degree-5 is the sweet spot. Their table shows p99 errors of 36 metres at city scale, 1.1 km at country scale, 7.6 km at continental scale.

Meng: The tradeoff is real. Degree-7 gets errors down to 62 metres at continent scale, but the circuit grows. Degree-5 keeps it to 334 constraints.

Tom: And at that size, proof generation takes 0.64 seconds on a MacBook M3 Max. Verification? 222 milliseconds. Proof size is 768 bytes.

Jane: That's tiny compared to typical C2PA manifests. It fits inside the metadata without bloating it.

Lu: The ZKP algorithm comparison on that page reinforces PLONK. Bulletproofs took 1.5 seconds just to verify the simple 73-constraint predicate. PLONK stayed at 220 milliseconds.

Meng: Groth16 was faster to prove, but the per-circuit ceremony is a deployment headache. PLONK's universal setup wins.

Tom: So the GPS proof is a clean proof-of-concept. Same predicate shape, different data type.

Jane: But location is low-dimensional. What happens when you move to 512-dim face embeddings? That's the next escalation.

Lu: The math should be simpler. Euclidean distance is just a sum of squared differences. No trig approximations needed.

Tom: Exactly. The interesting question becomes whether the circuit stays manageable at high dimension.

Jane: And whether verification time stays constant. That's the promise of PLONK, but we'll see if it holds.

Page 7 of the paper: Jane: We've moved from GPS to faces, and the shift is big. This page is about personality rights, not nav data.

Tom: Their system registers a protected biometric descriptor in a rights registry. A third party who wants to reuse an image computes their own descriptor and needs to check if it matches.

Lu: But the registered descriptor can't be public. A face template is irrevocable. Leak it once, and someone can spoof the likeness forever.

Meng: So they make the descriptor the hidden witness. The image-derived descriptor is public, and the proof shows the hidden registered descriptor is within a radius.

Tom: The predicate is exactly ℓ2 distance squared, compared to a threshold. No transcendental functions, no approximation. Just sums of squared differences.

Jane: They quantize embeddings to fixed-point integers with a scale of 1,000. The circuit then computes integer arithmetic inside the finite field.

Lu: The constraint count is remarkably small: 2D plus 23. For D=128 that's 279 constraints. Even the GPS circuit needed 334 constraints.

Meng: And proof time scales with dimension. They measured 0.44 seconds for D=32, 0.96 seconds for D=128, 6.28 seconds for D=512.

Jane: Verification stays around 250 milliseconds the whole way down the table. That's the constant-time verifier math.

Tom: So the bottleneck is proving, not checking. That's an important asymmetry for deployment.

Lu: The threshold R can be tuned without recompiling. The range-check bit width only changes by a few bits across practical face-recognition thresholds.

Meng: They also discuss the interpretation. A lower threshold makes the predicate more selective, fewer false accepts, but also fewer true matches. Higher threshold does the reverse.

Jane: It's basically a biometric operating point wrapped in a cryptographic proof.

Tom: And the same circuit, unchanged, later handles fingerprint descriptors. One design, many uses.

Lu: But there's a subtlety: embeddings need to be unit-normalised for those face models. ElasticFace-Cos outputs un-normalised features, so they normalise before the circuit. That matters for the math to align.

Meng: The next page shows the actual experiments. Five face recognition models, LFW benchmark, equal error rates, prototype screenshots.

Jane: I'm curious how the proof behaves with real embeddings. Does the ZKP quantization break the recognition accuracy?

Lu: That's exactly the kind of thing the next page checks.

Page 9 of the paper: Tom: We're now looking at the biometric benchmarking page. They take five face recognition models and run them through the ZKP circuit.

Jane: The models are ArcFace, FaceNet, AdaFace, and the two ElasticFace variants. All produce 512-dimensional embeddings, so they share a 1,047-constraint circuit.

Lu: They test on LFW's 6,000 pre-formed pairs. Same-person and different-person pairs give them equal error rate.

Meng: The table shows ArcFace at 4.88 percent EER, FaceNet at 1.18 percent, AdaFace at 10.22 percent, ElasticFace-Arc at 7.38 percent, ElasticFace-Cos at 7.28 percent.

Tom: FaceNet is clearly the strongest recognizer on this benchmark. Its verification accuracy hits 98.82 percent.

Jane: And all five models produce valid proofs. 5 out of 5 same-person pairs verified each time.

Lu: The proof generation times are all around 6.7 seconds for D=512. Verification around 320 milliseconds. The differences between models are tiny.

Meng: The paper also shows a DET curve plot. False accept rate against false reject rate. FaceNet sits closest to the bottom-left, which matches the EER.

Tom: There's a figure on that page showing dimension scaling. Constraint count grows as 2D plus 23. Prove time jumps super-linearly because each SRS tier doubling roughly triples the MSM cost.

Jane: So at D=2048 you're looking at 87 seconds to prove. Not interactive anymore. That's why they call D=512 the practical operating point.

Lu: And the right side shows a prototype screenshot. Someone queries an image, the ZKP checks the likeness against a hidden registered FaceNet descriptor, and licensing terms pop up.

Meng: That's the personality rights loop. The verifier learns whether the likeness matches, but never sees the registered template.

Tom: It's a clever inversion. The rights holder keeps the sensitive biometric secret, while the world can still enforce consent.

Jane: But there's an open question about recognition thresholds. They use each model's EER threshold from LFW. In the wild, that threshold shifts.

Lu: Right. The threshold controls both the biometric false-accept rate and the selectivity of the ZKP claim. It's a double-edged knob.

Meng: Next they move from faces to fingerprints. Same circuit, different descriptors, and a whole anti-spoofing story.

Jane: I want to see how that holds up against watermark transplant attacks.

Page 11 of the paper: Jane: We've gone from faces to fingerprints, and the twist is that the same ℓ2 circuit just gets reused. No redesign.

Tom: The context is the three-pillar provenance pipeline. Signed metadata, watermarking, fingerprinting. Watermarks can recover a manifest after social platforms strip the metadata.

Lu: But an attacker can transplant a watermark ID from one image to another. The recovered manifest then points to the wrong image. The fingerprint check catches that.

Meng: The catch is, the reference fingerprint itself shouldn't be public. It's a proprietary signal, and leaking it could let attackers reverse-engineer the model or craft adversarial images.

Tom: So the manifest stores a soft-redacted reference fingerprint. The query fingerprint is public, the reference is private, and the proof shows they're within a radius.

Jane: The protocol is basically a challenge-response. The watermark recovers a candidate manifest, the ZKP proves the manifest's hidden fingerprint is visually bound to the query image.

Lu: And the same circuit from the biometric section applies unmodified. That's a nice engineering payoff.

Meng: They evaluate on MIRFLICKR-25k, with 1,000 reference images and five benign transforms each. JPEG recompression, crops, brightness, contrast. That gives 5,000 benign pairs.

Tom: Plus 2,000 attack pairs where they transplant watermark IDs between images.

Jane: And they test four fingerprint descriptors: ResNet18 trained on ImageNet, DINO ViT-S/8, SimProv, and SSCD.

Lu: The threshold for each descriptor is set to 1.2 times the maximum benign ℓ2 distance across all references.

Meng: I love that the descriptors are ordered by training specificity. From generic ImageNet classifier to dedicated copy-detection model.

Tom: The expected performance gap shows up. Generic features struggle because semantically similar images share activations.

Jane: But the paper says DINO gets 99.7 percent attack rejection despite no copy-detection training. That's the self-supervised ViT's patch-level attention doing heavy lifting.

Lu: And SSCD hits 100 percent rejection. SimProv sits at 73.6 percent. RN18 only 20.9 percent.

Tom: So the proof circuit works across all of them, but the fingerprint quality determines whether the anti-spoofing check actually means anything.

Jane: The prove times vary with dimension: SimProv at 256 dims takes 2.3 seconds, DINO at 384 takes 2.9, and RN18/SSCD at 512 take around 6.5.

Lu: Verification stays around 330 milliseconds regardless. That's the PLONK consistency we saw in the face experiments.

Meng: So the whole system is coherent: one circuit, multiple domains, constant verification cost.

Jane: And the privacy benefits extend to fingerprint protection. You can't use the stored fingerprint to reverse-engineer the model.

Tom: The next page gives the full attack rejection numbers and the distributions. I'm curious how the benign and attack distances overlap.

Lu: The separation narrows as training specificity drops. That's the story of the figure.

Page 13 of the paper: Tom: We're now on the fingerprint results page. The table delivers the punchline.

Jane: RN18 rejects 418 out of 2,000 attacks, just 20.9 percent. SimProv improves to 73.6 percent. DINO jumps to 99.7 percent. SSCD hits 100 percent.

Lu: The harmonic mean metric, FR1, captures both acceptance of benigns and rejection of attacks. SSCD and DINO both get 1.00. RN18 gets 0.35, SimProv 0.85.

Meng: The figure on that page shows the ℓ2 distance distributions. Blue for benign transforms, red for transplant attacks. The dashed orange line is the threshold.

Jane: With SSCD, the red distribution sits far to the right. Zero overlap. With RN18, they blend together, which explains the poor rejection.

Tom: The paper orders the descriptors by training specificity. Generic ImageNet supervision is the worst. Self-supervised and contrastive copy-detection targets are the best.

Lu: DINO stands out because it was never trained for copy detection, yet its patch-level self-attention creates instance-level discriminative features. That's a surprising result.

Meng: And SimProv, which was trained for provenance, still misses 26 percent of attacks because MIRFLICKR has confusable pairs.

Tom: The proof times align with what we saw before. SimProv at D=256 takes 2.31 seconds. DINO at D=384 takes 2.90. RN18 and SSCD at D=512 take around 6.5.

Jane: Verification stays between 320 and 338 milliseconds. Proof size 768 bytes across the board.

Lu: So the cost structure is stable. The fingerprint algorithm's discriminative power is what actually determines safety.

Meng: That's an important lesson. A ZKP can't fix a weak descriptor. It only preserves the privacy of the descriptor you already have.

Tom: And this anti-spoofing layer makes watermark recovery robust. You can't just transplant an ID and fool the system.

Jane: But there's still a vulnerability at the protocol level. The conclusion mentions adaptive queries and low-entropy assertions. Like repeatedly querying GPS proximity to narrow down a location.

Lu: That's a real limitation. A zero-knowledge proof doesn't stop side-channel leakage through many queries.

Meng: For high-dimensional face embeddings, the search space is huge, so that attack is less practical. But for GPS, it's a genuine threat.

Jane: The next segment wraps everything. I'm hoping they discuss where this leaves the evolving provenance ecosystem.

Conclusion: Tom: Time to wrap up. We've seen soft redaction turn provenance from a privacy leak into a controlled disclosure system.

Jane: The paper delivered three solid demonstrations: GPS proximity, biometric likeness, and fingerprint-based anti-spoofing. All built on the same distance proof.

Lu: The engineering choices matter. PLONK gives constant-size proofs and sub-second verification. Chebyshev approximation makes trig math feasible in-circuit. Fixed-point quantization keeps embeddings manageable.

Meng: The practical numbers stick with me. Proofs in seconds, verification in milliseconds, 768-byte proofs. That fits inside existing C2PA manifests.

Tom: And it all anchors through the existing assertion hash, so no spec changes are required.

Jane: The implications go beyond technical convenience. Personality rights, consent, and licensing can now be enforced without exposing biometric templates.

Lu: The fingerprint work also strengthens the three-pillar provenance pipeline. You can recover stripped metadata and verify it without publicly leaking the reference descriptor.

Meng: But the limitations are honest. They only handle distance predicates. Set membership, temporal constraints, compound rights expressions are still open.

Tom: And the adaptive query attack on low-entropy assertions like GPS is a real concern. The paper flags it clearly.

Jane: Still, the direction is compelling. Provenance moves from binary disclosure to selective, verifiable claims about what's hidden.

Lu: For me, the biggest takeaway is the reusable circuit. One ℓ2 distance proof serves at least three completely different use cases.

Meng: And the verification time stays flat regardless of dimension. That's what makes it scalable for publishers and platforms.

Tom: So the paper charts a practical path. ZKPs can extend C2PA, not replace it.

Jane: We've had a great run with this one. Thanks to the authors, Muhammad Awan and John Collomosse, and thanks to all of you for listening.

Lu: It's a thoughtful blend of cryptography, computer vision, and real-world policy. Rare to see all three in one paper.

Meng: And it leaves plenty of room for future work. Richer predicates, better threat models, maybe a standard ZKP assertion type.

Tom: We'll be here when that arrives. For now, we're signing off.

Jane: Stay curious, stay critical, and keep your metadata honest. See you on the next one.